Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
xxadev
jenkins
提交
655be64a
J
jenkins
项目概览
xxadev
/
jenkins
与 Fork 源项目一致
从无法访问的项目Fork
通知
3
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jenkins
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
未验证
提交
655be64a
编写于
1月 25, 2018
作者:
J
Jesse Glick
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
[JENKINS-49147] Tolerate unusual CodeSource.location format from old versions of Tomcat.
上级
0d1f80ba
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
39 addition
and
6 deletion
+39
-6
core/src/main/java/jenkins/security/ClassFilterImpl.java
core/src/main/java/jenkins/security/ClassFilterImpl.java
+39
-6
未找到文件。
core/src/main/java/jenkins/security/ClassFilterImpl.java
浏览文件 @
655be64a
...
...
@@ -28,6 +28,7 @@ import com.google.common.collect.ImmutableSet;
import
hudson.ExtensionList
;
import
hudson.Main
;
import
hudson.remoting.ClassFilter
;
import
hudson.remoting.Which
;
import
java.io.File
;
import
java.io.FileInputStream
;
import
java.io.IOException
;
...
...
@@ -49,6 +50,8 @@ import java.util.logging.Logger;
import
java.util.regex.Matcher
;
import
java.util.regex.Pattern
;
import
java.util.stream.Collectors
;
import
javax.annotation.CheckForNull
;
import
javax.annotation.Nonnull
;
import
jenkins.model.Jenkins
;
import
jenkins.util.SystemProperties
;
import
org.apache.commons.io.IOUtils
;
...
...
@@ -71,11 +74,14 @@ public class ClassFilterImpl extends ClassFilter {
private
static
/* not final */
boolean
SUPPRESS_WHITELIST
=
SystemProperties
.
getBoolean
(
"jenkins.security.ClassFilterImpl.SUPPRESS_WHITELIST"
);
private
static
/* not final */
boolean
SUPPRESS_ALL
=
SystemProperties
.
getBoolean
(
"jenkins.security.ClassFilterImpl.SUPPRESS_ALL"
);
private
static
final
String
JENKINS_LOC
=
codeSource
(
Jenkins
.
class
);
private
static
final
String
REMOTING_LOC
=
codeSource
(
ClassFilter
.
class
);
/**
* Register this implementation as the default in the system.
*/
public
static
void
register
()
{
if
(
Main
.
isUnitTest
&&
J
enkins
.
class
.
getProtectionDomain
().
getCodeSource
().
getLocation
()
==
null
)
{
if
(
Main
.
isUnitTest
&&
J
ENKINS_LOC
==
null
)
{
mockOff
();
return
;
}
...
...
@@ -146,10 +152,9 @@ public class ClassFilterImpl extends ClassFilter {
LOGGER
.
log
(
Level
.
FINE
,
"permitting {0} since it is an enum"
,
name
);
return
false
;
}
CodeSource
codeSource
=
c
.
getProtectionDomain
().
getCodeSource
();
URL
location
=
codeSource
!=
null
?
codeSource
.
getLocation
()
:
null
;
String
location
=
codeSource
(
c
);
if
(
location
!=
null
)
{
if
(
isLocationWhitelisted
(
location
.
toString
()
))
{
if
(
isLocationWhitelisted
(
location
))
{
LOGGER
.
log
(
Level
.
FINE
,
"permitting {0} due to its location in {1}"
,
new
Object
[]
{
name
,
location
});
return
false
;
}
...
...
@@ -176,11 +181,11 @@ public class ClassFilterImpl extends ClassFilter {
private
static
final
Pattern
CLASSES_JAR
=
Pattern
.
compile
(
"(file:/.+/)WEB-INF/lib/classes[.]jar"
);
private
boolean
isLocationWhitelisted
(
String
_loc
)
{
return
codeSourceCache
.
computeIfAbsent
(
_loc
,
loc
->
{
if
(
loc
.
equals
(
J
enkins
.
class
.
getProtectionDomain
().
getCodeSource
().
getLocation
().
toString
()
))
{
if
(
loc
.
equals
(
J
ENKINS_LOC
))
{
LOGGER
.
log
(
Level
.
FINE
,
"{0} seems to be the location of Jenkins core, OK"
,
loc
);
return
true
;
}
if
(
loc
.
equals
(
ClassFilter
.
class
.
getProtectionDomain
().
getCodeSource
().
getLocation
().
toString
()
))
{
if
(
loc
.
equals
(
REMOTING_LOC
))
{
LOGGER
.
log
(
Level
.
FINE
,
"{0} seems to be the location of Remoting, OK"
,
loc
);
return
true
;
}
...
...
@@ -241,6 +246,34 @@ public class ClassFilterImpl extends ClassFilter {
});
}
/**
* Tries to determine what JAR file a given class was loaded from.
* The location is an opaque string suitable only for comparison to others.
* Similar to {@link Which#jarFile(Class)} but potentially faster, and more tolerant of unknown URL formats.
* @param c some class
* @return something typically like {@code file:/…/plugins/structs/WEB-INF/lib/structs-1.10.jar};
* or null for classes in the Java Platform, some generated classes, etc.
*/
private
static
@CheckForNull
String
codeSource
(
@Nonnull
Class
<?>
c
)
{
CodeSource
cs
=
c
.
getProtectionDomain
().
getCodeSource
();
if
(
cs
==
null
)
{
return
null
;
}
URL
loc
=
cs
.
getLocation
();
if
(
loc
==
null
)
{
return
null
;
}
String
r
=
loc
.
toString
();
if
(
r
.
endsWith
(
".class"
))
{
// JENKINS-49147: Tomcat bug. Now do the more expensive check…
String
suffix
=
c
.
getName
().
replace
(
'.'
,
'/'
)
+
".class"
;
if
(
r
.
endsWith
(
suffix
))
{
r
=
r
.
substring
(
0
,
r
.
length
()
-
suffix
.
length
());
}
}
return
r
;
}
private
static
boolean
isPluginManifest
(
Manifest
mf
)
{
Attributes
attr
=
mf
.
getMainAttributes
();
return
attr
.
getValue
(
"Short-Name"
)
!=
null
&&
(
attr
.
getValue
(
"Plugin-Version"
)
!=
null
||
attr
.
getValue
(
"Jenkins-Version"
)
!=
null
)
||
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录